Warning: Permanently added '10.128.0.221' (ED25519) to the list of known hosts. 1970/01/01 00:00:30 parsed 1 programs 1970/01/01 00:00:30 serving rpc on tcp://39355 syzkaller login: [ 31.104524][ T4339] cgroup: Unknown subsys name 'net' [ 31.322761][ T4339] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 31.595539][ T4339] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k SSFS [ 38.217374][ T1669] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.218884][ T1669] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.222405][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 38.228279][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 38.229675][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 38.231794][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 38.633797][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.635335][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.636797][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.656849][ T4388] infiniband rxe0: set active [ 38.658055][ T4365] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.659467][ T4388] infiniband rxe0: added rxe_eth0 [ 38.673927][ T4388] RDS/IB: rxe0: added [ 38.674799][ T4388] smc: adding ib device rxe0 with port count 1 [ 38.675866][ T4388] smc: ib device rxe0 port 1 has pnetid [ 38.677368][ T24] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.680878][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.698033][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.715004][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.732086][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.748373][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.765177][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.781459][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.797937][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.822208][ T4388] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.921812][ T4388] chnl_net:caif_netlink_parms(): no params data found [ 38.955732][ T4388] bridge0: port 1(bridge_slave_0) entered blocking state [ 38.959562][ T4388] bridge0: port 1(bridge_slave_0) entered disabled state [ 38.961371][ T4388] device bridge_slave_0 entered promiscuous mode [ 38.964019][ T4388] bridge0: port 2(bridge_slave_1) entered blocking state [ 38.965298][ T4388] bridge0: port 2(bridge_slave_1) entered disabled state [ 38.966976][ T4388] device bridge_slave_1 entered promiscuous mode [ 38.976681][ T4388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 38.979256][ T4388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 38.982087][ T3901] rxe_eth0 speed is unknown, defaulting to 1000 [ 38.984981][ T3994] infiniband rxe0: set active [ 38.997868][ T24] rxe_eth0 speed is unknown, defaulting to 1000 [ 39.002962][ T4388] team0: Port device team_slave_0 added [ 39.004923][ T4388] team0: Port device team_slave_1 added [ 39.011172][ T4388] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 39.012383][ T4388] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.016559][ T4388] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 39.020706][ T4388] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 39.022037][ T4388] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 39.026524][ T4388] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 39.081442][ T4388] device hsr_slave_0 entered promiscuous mode [ 39.100403][ T4388] device hsr_slave_1 entered promiscuous mode [ 39.187411][ T4388] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 39.224544][ T4388] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 39.281509][ T4388] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 39.301225][ T4388] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 39.363054][ T4388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 39.366795][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 39.368729][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 39.372414][ T4388] 8021q: adding VLAN 0 to HW filter on device team0 [ 39.374743][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 39.376327][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 39.378216][ T9] bridge0: port 1(bridge_slave_0) entered blocking state [ 39.379512][ T9] bridge0: port 1(bridge_slave_0) entered forwarding state [ 39.381403][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 39.384224][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 39.385997][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 39.387641][ T9] bridge0: port 2(bridge_slave_1) entered blocking state [ 39.388735][ T9] bridge0: port 2(bridge_slave_1) entered forwarding state [ 39.391928][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 39.394577][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 39.397844][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 39.400581][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 39.402512][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 39.405299][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 39.407079][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 39.409881][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 39.413430][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 39.416600][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 39.418971][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 39.422672][ T4388] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 39.481272][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 39.482642][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 39.485932][ T4388] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 39.492133][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 39.493837][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 39.499703][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 39.502443][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 39.505130][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 39.506742][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 39.508844][ T4388] device veth0_vlan entered promiscuous mode [ 39.521322][ T4388] device veth1_vlan entered promiscuous mode [ 39.527629][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 39.529274][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 39.531523][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 39.533169][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 39.535900][ T4388] device veth0_macvtap entered promiscuous mode [ 39.538766][ T4388] device veth1_macvtap entered promiscuous mode [ 39.545528][ T4388] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 39.546883][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 39.548728][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 39.551267][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 39.553092][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 39.563813][ T4388] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 39.566003][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 39.567865][ T39] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 39.569795][ T4388] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.571499][ T4388] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.572950][ T4388] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.574341][ T4388] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 39.643767][ T4455] rxe_eth0 speed is unknown, defaulting to 1000 [ 39.752054][ T4459] rxe_eth0 speed is unknown, defaulting to 1000 [ 40.176962][ T4464] rxe_eth0 speed is unknown, defaulting to 1000 [ 40.296232][ T4469] rxe_eth0 speed is unknown, defaulting to 1000 [ 40.674168][ T4477] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 40.682900][ T4477] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 40.685336][ T4477] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 40.687163][ T4477] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 40.688832][ T4477] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 40.690890][ T4477] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 40.717952][ T4474] rxe_eth0 speed is unknown, defaulting to 1000 [ 40.851327][ T4481] rxe_eth0 speed is unknown, defaulting to 1000 [ 41.120630][ T4483] rxe_eth0 speed is unknown, defaulting to 1000 1970/01/01 00:00:41 executed programs: 0 [ 41.309196][ T48] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 41.313880][ T48] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 41.315494][ T48] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 41.317106][ T48] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 41.318697][ T48] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 41.320439][ T48] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 41.331355][ T4486] rxe_eth0 speed is unknown, defaulting to 1000 [ 41.673434][ T11] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 41.699025][ T4486] chnl_net:caif_netlink_parms(): no params data found [ 41.713516][ T4486] bridge0: port 1(bridge_slave_0) entered blocking state [ 41.714978][ T4486] bridge0: port 1(bridge_slave_0) entered disabled state [ 41.716698][ T4486] device bridge_slave_0 entered promiscuous mode [ 41.718506][ T4486] bridge0: port 2(bridge_slave_1) entered blocking state [ 41.719718][ T4486] bridge0: port 2(bridge_slave_1) entered disabled state [ 41.721737][ T4486] device bridge_slave_1 entered promiscuous mode [ 41.728949][ T4486] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 41.731569][ T4486] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 41.737727][ T4486] team0: Port device team_slave_0 added [ 41.739422][ T4486] team0: Port device team_slave_1 added [ 41.744443][ T4486] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 41.745702][ T4486] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 41.753115][ T4486] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 41.755546][ T4486] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 41.756775][ T4486] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 41.761661][ T4486] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 41.801612][ T4486] device hsr_slave_0 entered promiscuous mode [ 41.850288][ T4486] device hsr_slave_1 entered promiscuous mode [ 41.890261][ T4486] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 41.891715][ T4486] Cannot create hsr debugfs directory [ 43.360550][ T48] Bluetooth: hci0: command 0x0409 tx timeout [ 44.771224][ T11] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 44.851361][ T11] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.002196][ T11] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 45.440352][ T48] Bluetooth: hci0: command 0x041b tx timeout [ 46.163239][ T4486] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 46.302268][ T4486] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 46.382027][ T4486] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 46.472391][ T4486] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 46.601893][ T4486] 8021q: adding VLAN 0 to HW filter on device bond0 [ 46.605390][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 46.607008][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 46.609424][ T4486] 8021q: adding VLAN 0 to HW filter on device team0 [ 46.674418][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 46.676131][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 46.677651][ T56] bridge0: port 1(bridge_slave_0) entered blocking state [ 46.679184][ T56] bridge0: port 1(bridge_slave_0) entered forwarding state [ 46.680726][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 46.683510][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 46.685352][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 46.686887][ T56] bridge0: port 2(bridge_slave_1) entered blocking state [ 46.688051][ T56] bridge0: port 2(bridge_slave_1) entered forwarding state [ 46.690877][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 46.693792][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 46.696568][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 46.698664][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 46.700474][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 46.703085][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 46.705000][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 46.707636][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 46.709155][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 46.713292][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 46.715171][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 46.717412][ T4486] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 46.797173][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 46.798671][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 46.802346][ T4486] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 46.807664][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 46.809458][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 46.817440][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 46.819681][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 46.822126][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 46.823700][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 46.826000][ T4486] device veth0_vlan entered promiscuous mode [ 46.828967][ T4486] device veth1_vlan entered promiscuous mode [ 46.836772][ T4486] device veth0_macvtap entered promiscuous mode [ 46.839717][ T4486] device veth1_macvtap entered promiscuous mode [ 46.842745][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 46.844354][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 46.845958][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 46.847695][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 46.849274][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 46.860970][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 46.865582][ T4486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 46.867460][ T4486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.869591][ T4486] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 46.871359][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 46.873082][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 46.881077][ T4486] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 46.882821][ T4486] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 46.884863][ T4486] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 46.887769][ T4486] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.889242][ T4486] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.893442][ T4486] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.895043][ T4486] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 46.898281][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 46.900273][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 46.924454][ T1669] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 46.925841][ T1669] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 46.927319][ T1669] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 46.938735][ T1669] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 46.940438][ T1669] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 46.942185][ T56] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready 1970/01/01 00:00:46 executed programs: 2 [ 47.004677][ T4548] gadgetfs: bound to dummy_udc driver [ 47.019599][ T4549] gadgetfs: bound to dummy_udc driver [ 47.035150][ T11] device hsr_slave_0 left promiscuous mode [ 47.047389][ T4550] syz.0.19 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.049117][ T4550] CPU: 1 PID: 4550 Comm: syz.0.19 Not tainted syzkaller #0 [ 47.050322][ T4550] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.052422][ T4550] Call trace: [ 47.053097][ T4550] dump_backtrace+0x1c4/0x1f0 [ 47.054073][ T4550] show_stack+0x2c/0x3c [ 47.054896][ T4550] __dump_stack+0x30/0x40 [ 47.055793][ T4550] dump_stack_lvl+0xf4/0x15c [ 47.056687][ T4550] dump_stack+0x1c/0x5c [ 47.057519][ T4550] dump_header+0xc0/0x724 [ 47.058379][ T4550] oom_kill_process+0x35c/0x660 [ 47.059346][ T4550] out_of_memory+0xbf0/0xf70 [ 47.060244][ T4550] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.061278][ T4550] try_charge_memcg+0xa4c/0x1390 [ 47.062263][ T4550] obj_cgroup_charge+0x178/0x2e4 [ 47.063188][ T4550] slab_pre_alloc_hook+0x2fc/0x31c [ 47.064123][ T4550] kmem_cache_alloc_lru+0x60/0x284 [ 47.065071][ T4550] new_inode_pseudo+0xdc/0x1cc [ 47.065959][ T4550] new_inode+0x38/0x174 [ 47.066706][ T4550] gadgetfs_create_file+0x74/0x258 [ 47.067654][ T4550] gadgetfs_bind+0x3a8/0x7b0 [ 47.068561][ T4550] gadget_bind_driver+0x26c/0x684 [ 47.069510][ T4550] really_probe+0x3a0/0xac4 [ 47.070329][ T4550] __driver_probe_device+0x1c8/0x368 [ 47.071295][ T4550] driver_probe_device+0x78/0x324 [ 47.072203][ T4550] __driver_attach+0x3bc/0x614 [ 47.073085][ T4550] bus_for_each_dev+0x148/0x1d0 [ 47.073984][ T4550] driver_attach+0x50/0x60 [ 47.074796][ T4550] bus_add_driver+0x2c0/0x518 [ 47.075681][ T4550] driver_register+0x200/0x37c [ 47.076562][ T4550] usb_gadget_register_driver_owner+0xf0/0x25c [ 47.077661][ T4550] dev_config+0xba8/0xfec [ 47.078484][ T4550] vfs_write+0x2a8/0x7c8 [ 47.079253][ T4550] ksys_write+0x12c/0x228 [ 47.080141][ T4550] __arm64_sys_write+0x7c/0x90 [ 47.081043][ T4550] invoke_syscall+0x98/0x290 [ 47.081933][ T4550] el0_svc_common+0x13c/0x258 [ 47.082832][ T4550] do_el0_svc+0x5c/0x134 [ 47.083643][ T4550] el0_svc+0x58/0x12c [ 47.084340][ T4550] el0t_64_sync_handler+0x84/0xf0 [ 47.085231][ T4550] el0t_64_sync+0x18c/0x190 [ 47.090723][ T11] device hsr_slave_1 left promiscuous mode [ 47.091978][ T4550] memory: usage 28kB, limit 96kB, failcnt 43 [ 47.093013][ T4550] memory+swap: usage 28kB, limit 9007199254740988kB, failcnt 0 [ 47.094291][ T4550] kmem: usage 28kB, limit 9007199254740988kB, failcnt 0 [ 47.095498][ T4550] Memory cgroup stats for /syz0/test: [ 47.095688][ T4550] anon 0 [ 47.095688][ T4550] file 0 [ 47.095688][ T4550] kernel 28672 [ 47.095688][ T4550] kernel_stack 0 [ 47.095688][ T4550] pagetables 0 [ 47.095688][ T4550] sec_pagetables 0 [ 47.095688][ T4550] percpu 0 [ 47.095688][ T4550] sock 0 [ 47.095688][ T4550] vmalloc 0 [ 47.095688][ T4550] shmem 0 [ 47.095688][ T4550] zswap 0 [ 47.095688][ T4550] zswapped 0 [ 47.095688][ T4550] file_mapped 0 [ 47.095688][ T4550] file_dirty 0 [ 47.095688][ T4550] file_writeback 0 [ 47.095688][ T4550] swapcached 0 [ 47.095688][ T4550] anon_thp 0 [ 47.095688][ T4550] file_thp 0 [ 47.095688][ T4550] shmem_thp 0 [ 47.095688][ T4550] inactive_anon 0 [ 47.095688][ T4550] active_anon 0 [ 47.095688][ T4550] inactive_file 0 [ 47.095688][ T4550] active_file 0 [ 47.095688][ T4550] unevictable 0 [ 47.095688][ T4550] slab_reclaimable 25952 [ 47.095688][ T4550] slab_unreclaimable 2664 [ 47.095688][ T4550] slab 28616 [ 47.095688][ T4550] workingset_refault_anon 0 [ 47.113517][ T4550] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.19,pid=4550,uid=0 [ 47.117104][ T4550] Memory cgroup out of memory: Killed process 4550 (syz.0.19) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 47.122971][ T4550] gadgetfs: bound to dummy_udc driver [ 47.171526][ T4551] gadgetfs: bound to dummy_udc driver [ 47.181327][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 47.182641][ T11] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 47.184740][ T11] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 47.186074][ T11] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 47.187526][ T11] device bridge_slave_1 left promiscuous mode [ 47.189029][ T11] bridge0: port 2(bridge_slave_1) entered disabled state [ 47.194222][ T4552] gadgetfs: bound to dummy_udc driver [ 47.209007][ T4553] syz.0.22 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.212511][ T4553] CPU: 0 PID: 4553 Comm: syz.0.22 Not tainted syzkaller #0 [ 47.213728][ T4553] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.215315][ T4553] Call trace: [ 47.215843][ T4553] dump_backtrace+0x1c4/0x1f0 [ 47.216627][ T4553] show_stack+0x2c/0x3c [ 47.217336][ T4553] __dump_stack+0x30/0x40 [ 47.218100][ T4553] dump_stack_lvl+0xf4/0x15c [ 47.218854][ T4553] dump_stack+0x1c/0x5c [ 47.219567][ T4553] dump_header+0xc0/0x724 [ 47.220339][ T4553] oom_kill_process+0x35c/0x660 [ 47.221271][ T4553] out_of_memory+0xbf0/0xf70 [ 47.222125][ T4553] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.223130][ T4553] try_charge_memcg+0xa4c/0x1390 [ 47.224048][ T4553] obj_cgroup_charge+0x178/0x2e4 [ 47.224982][ T4553] slab_pre_alloc_hook+0x2fc/0x31c [ 47.225935][ T4553] kmem_cache_alloc_lru+0x60/0x284 [ 47.226910][ T4553] __d_alloc+0x40/0x68c [ 47.227686][ T4553] d_alloc+0x54/0x208 [ 47.228419][ T4553] lookup_one_qstr_excl+0xbc/0x230 [ 47.229365][ T4553] filename_create+0x1d0/0x3a8 [ 47.230222][ T4553] do_mkdirat+0xac/0x3ec [ 47.230983][ T4553] __arm64_sys_mkdirat+0x90/0xa8 [ 47.231904][ T4553] invoke_syscall+0x98/0x290 [ 47.232764][ T4553] el0_svc_common+0x13c/0x258 [ 47.233631][ T4553] do_el0_svc+0x5c/0x134 [ 47.234409][ T4553] el0_svc+0x58/0x12c [ 47.235134][ T4553] el0t_64_sync_handler+0x84/0xf0 [ 47.236058][ T4553] el0t_64_sync+0x18c/0x190 [ 47.237977][ T4553] memory: usage 60kB, limit 96kB, failcnt 87 [ 47.238792][ T11] device bridge_slave_0 left promiscuous mode [ 47.239030][ T4553] memory+swap: usage 60kB, limit 9007199254740988kB, failcnt 0 [ 47.241605][ T4553] kmem: usage 4kB, limit 9007199254740988kB, failcnt 0 [ 47.242697][ T4553] Memory cgroup stats for /syz0/test: [ 47.242766][ T11] bridge0: port 1(bridge_slave_0) entered disabled state [ 47.242782][ T4553] anon 0 [ 47.242782][ T4553] file 0 [ 47.242782][ T4553] kernel 4096 [ 47.242782][ T4553] kernel_stack 0 [ 47.242782][ T4553] pagetables 0 [ 47.242782][ T4553] sec_pagetables 0 [ 47.242782][ T4553] percpu 0 [ 47.242782][ T4553] sock 0 [ 47.242782][ T4553] vmalloc 0 [ 47.242782][ T4553] shmem 0 [ 47.242782][ T4553] zswap 0 [ 47.242782][ T4553] zswapped 0 [ 47.242782][ T4553] file_mapped 0 [ 47.242782][ T4553] file_dirty 0 [ 47.242782][ T4553] file_writeback 0 [ 47.242782][ T4553] swapcached 0 [ 47.242782][ T4553] anon_thp 0 [ 47.242782][ T4553] file_thp 0 [ 47.242782][ T4553] shmem_thp 0 [ 47.242782][ T4553] inactive_anon 0 [ 47.242782][ T4553] active_anon 0 [ 47.242782][ T4553] inactive_file 0 [ 47.242782][ T4553] active_file 0 [ 47.242782][ T4553] unevictable 0 [ 47.242782][ T4553] slab_reclaimable 2304 [ 47.242782][ T4553] slab_unreclaimable 0 [ 47.242782][ T4553] slab 2304 [ 47.242782][ T4553] workingset_refault_anon 0 [ 47.260999][ T4553] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.22,pid=4553,uid=0 [ 47.264108][ T4553] Memory cgroup out of memory: Killed process 4553 (syz.0.22) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 47.312928][ T4554] gadgetfs: bound to dummy_udc driver [ 47.326644][ T4555] gadgetfs: bound to dummy_udc driver [ 47.343653][ T4556] syz.0.25 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.345487][ T4556] CPU: 1 PID: 4556 Comm: syz.0.25 Not tainted syzkaller #0 [ 47.346691][ T4556] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.348361][ T4556] Call trace: [ 47.348906][ T4556] dump_backtrace+0x1c4/0x1f0 [ 47.349717][ T4556] show_stack+0x2c/0x3c [ 47.350457][ T4556] __dump_stack+0x30/0x40 [ 47.351268][ T4556] dump_stack_lvl+0xf4/0x15c [ 47.352093][ T4556] dump_stack+0x1c/0x5c [ 47.352827][ T4556] dump_header+0xc0/0x724 [ 47.353619][ T4556] oom_kill_process+0x35c/0x660 [ 47.354493][ T4556] out_of_memory+0xbf0/0xf70 [ 47.355332][ T4556] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.356328][ T4556] try_charge_memcg+0xa4c/0x1390 [ 47.357187][ T4556] obj_cgroup_charge+0x178/0x2e4 [ 47.358101][ T4556] slab_pre_alloc_hook+0x2fc/0x31c [ 47.359021][ T4556] kmem_cache_alloc_lru+0x60/0x284 [ 47.359926][ T4556] new_inode_pseudo+0xdc/0x1cc [ 47.360717][ T4556] new_inode+0x38/0x174 [ 47.361440][ T4556] gadgetfs_create_file+0x74/0x258 [ 47.362362][ T4556] gadgetfs_bind+0x3a8/0x7b0 [ 47.363197][ T4556] gadget_bind_driver+0x26c/0x684 [ 47.364112][ T4556] really_probe+0x3a0/0xac4 [ 47.364904][ T4556] __driver_probe_device+0x1c8/0x368 [ 47.365885][ T4556] driver_probe_device+0x78/0x324 [ 47.366815][ T4556] __driver_attach+0x3bc/0x614 [ 47.367661][ T4556] bus_for_each_dev+0x148/0x1d0 [ 47.368566][ T4556] driver_attach+0x50/0x60 [ 47.369368][ T4556] bus_add_driver+0x2c0/0x518 [ 47.370243][ T4556] driver_register+0x200/0x37c [ 47.371119][ T4556] usb_gadget_register_driver_owner+0xf0/0x25c [ 47.372265][ T4556] dev_config+0xba8/0xfec [ 47.373074][ T4556] vfs_write+0x2a8/0x7c8 [ 47.373903][ T4556] ksys_write+0x12c/0x228 [ 47.374781][ T4556] __arm64_sys_write+0x7c/0x90 [ 47.375721][ T4556] invoke_syscall+0x98/0x290 [ 47.376621][ T4556] el0_svc_common+0x13c/0x258 [ 47.377512][ T4556] do_el0_svc+0x5c/0x134 [ 47.378278][ T4556] el0_svc+0x58/0x12c [ 47.379029][ T4556] el0t_64_sync_handler+0x84/0xf0 [ 47.379997][ T4556] el0t_64_sync+0x18c/0x190 [ 47.382499][ T4556] memory: usage 64kB, limit 96kB, failcnt 130 [ 47.383619][ T4556] memory+swap: usage 64kB, limit 9007199254740988kB, failcnt 0 [ 47.384986][ T4556] kmem: usage 64kB, limit 9007199254740988kB, failcnt 0 [ 47.386238][ T4556] Memory cgroup stats for /syz0/test: [ 47.386325][ T4556] anon 0 [ 47.386325][ T4556] file 0 [ 47.386325][ T4556] kernel 65536 [ 47.386325][ T4556] kernel_stack 0 [ 47.386325][ T4556] pagetables 0 [ 47.386325][ T4556] sec_pagetables 0 [ 47.386325][ T4556] percpu 0 [ 47.386325][ T4556] sock 0 [ 47.386325][ T4556] vmalloc 0 [ 47.386325][ T4556] shmem 0 [ 47.386325][ T4556] zswap 0 [ 47.386325][ T4556] zswapped 0 [ 47.386325][ T4556] file_mapped 0 [ 47.386325][ T4556] file_dirty 0 [ 47.386325][ T4556] file_writeback 0 [ 47.386325][ T4556] swapcached 0 [ 47.386325][ T4556] anon_thp 0 [ 47.386325][ T4556] file_thp 0 [ 47.386325][ T4556] shmem_thp 0 [ 47.386325][ T4556] inactive_anon 0 [ 47.386325][ T4556] active_anon 0 [ 47.386325][ T4556] inactive_file 0 [ 47.386325][ T4556] active_file 0 [ 47.386325][ T4556] unevictable 0 [ 47.386325][ T4556] slab_reclaimable 57632 [ 47.386325][ T4556] slab_unreclaimable 5328 [ 47.386325][ T4556] slab 62960 [ 47.386325][ T4556] workingset_refault_anon 0 [ 47.392197][ T11] device veth1_macvtap left promiscuous mode [ 47.403845][ T4556] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.25,pid=4556,uid=0 [ 47.404657][ T11] device veth0_macvtap left promiscuous mode [ 47.407116][ T4556] Memory cgroup out of memory: Killed process 4556 (syz.0.25) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 47.408184][ T11] device veth1_vlan left promiscuous mode [ 47.411478][ T4556] gadgetfs: bound to dummy_udc driver [ 47.412987][ T11] device veth0_vlan left promiscuous mode [ 47.461459][ T4557] gadgetfs: bound to dummy_udc driver [ 47.479979][ T4558] gadgetfs: bound to dummy_udc driver [ 47.495347][ T4559] syz.0.28 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.497097][ T4559] CPU: 0 PID: 4559 Comm: syz.0.28 Not tainted syzkaller #0 [ 47.498307][ T4559] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.499980][ T4559] Call trace: [ 47.500615][ T4559] dump_backtrace+0x1c4/0x1f0 [ 47.501471][ T4559] show_stack+0x2c/0x3c [ 47.502374][ T4559] __dump_stack+0x30/0x40 [ 47.503327][ T4559] dump_stack_lvl+0xf4/0x15c [ 47.504320][ T4559] dump_stack+0x1c/0x5c [ 47.505193][ T4559] dump_header+0xc0/0x724 [ 47.506114][ T4559] oom_kill_process+0x35c/0x660 [ 47.507003][ T4559] out_of_memory+0xbf0/0xf70 [ 47.507799][ T4559] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.508818][ T4559] try_charge_memcg+0xa4c/0x1390 [ 47.509729][ T4559] obj_cgroup_charge+0x178/0x2e4 [ 47.510642][ T4559] slab_pre_alloc_hook+0x2fc/0x31c [ 47.511622][ T4559] kmem_cache_alloc_lru+0x60/0x284 [ 47.512563][ T4559] __d_alloc+0x40/0x68c [ 47.513349][ T4559] d_alloc+0x54/0x208 [ 47.514104][ T4559] lookup_one_qstr_excl+0xbc/0x230 [ 47.515028][ T4559] filename_create+0x1d0/0x3a8 [ 47.515911][ T4559] do_mkdirat+0xac/0x3ec [ 47.516687][ T4559] __arm64_sys_mkdirat+0x90/0xa8 [ 47.517553][ T4559] invoke_syscall+0x98/0x290 [ 47.518390][ T4559] el0_svc_common+0x13c/0x258 [ 47.519259][ T4559] do_el0_svc+0x5c/0x134 [ 47.520033][ T4559] el0_svc+0x58/0x12c [ 47.520761][ T4559] el0t_64_sync_handler+0x84/0xf0 [ 47.521682][ T4559] el0t_64_sync+0x18c/0x190 [ 47.526699][ T48] Bluetooth: hci0: command 0x040f tx timeout [ 47.528017][ T4559] memory: usage 96kB, limit 96kB, failcnt 173 [ 47.529161][ T4559] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 47.533739][ T4559] kmem: usage 28kB, limit 9007199254740988kB, failcnt 0 [ 47.535071][ T4559] Memory cgroup stats for /syz0/test: [ 47.535157][ T4559] anon 0 [ 47.535157][ T4559] file 0 [ 47.535157][ T4559] kernel 28672 [ 47.535157][ T4559] kernel_stack 0 [ 47.535157][ T4559] pagetables 0 [ 47.535157][ T4559] sec_pagetables 0 [ 47.535157][ T4559] percpu 0 [ 47.535157][ T4559] sock 0 [ 47.535157][ T4559] vmalloc 0 [ 47.535157][ T4559] shmem 0 [ 47.535157][ T4559] zswap 0 [ 47.535157][ T4559] zswapped 0 [ 47.535157][ T4559] file_mapped 0 [ 47.535157][ T4559] file_dirty 0 [ 47.535157][ T4559] file_writeback 0 [ 47.535157][ T4559] swapcached 0 [ 47.535157][ T4559] anon_thp 0 [ 47.535157][ T4559] file_thp 0 [ 47.535157][ T4559] shmem_thp 0 [ 47.535157][ T4559] inactive_anon 0 [ 47.535157][ T4559] active_anon 0 [ 47.535157][ T4559] inactive_file 0 [ 47.535157][ T4559] active_file 0 [ 47.535157][ T4559] unevictable 0 [ 47.535157][ T4559] slab_reclaimable 27648 [ 47.535157][ T4559] slab_unreclaimable 0 [ 47.535157][ T4559] slab 27648 [ 47.535157][ T4559] workingset_refault_anon 0 [ 47.552885][ T4559] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.28,pid=4559,uid=0 [ 47.555857][ T4559] Memory cgroup out of memory: Killed process 4559 (syz.0.28) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 47.601524][ T4560] gadgetfs: bound to dummy_udc driver [ 47.615920][ T4561] gadgetfs: bound to dummy_udc driver [ 47.630852][ T4562] syz.0.31 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.632557][ T4562] CPU: 0 PID: 4562 Comm: syz.0.31 Not tainted syzkaller #0 [ 47.633941][ T4562] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.635613][ T4562] Call trace: [ 47.636254][ T4562] dump_backtrace+0x1c4/0x1f0 [ 47.637083][ T4562] show_stack+0x2c/0x3c [ 47.637809][ T4562] __dump_stack+0x30/0x40 [ 47.638578][ T4562] dump_stack_lvl+0xf4/0x15c [ 47.639379][ T4562] dump_stack+0x1c/0x5c [ 47.640055][ T4562] dump_header+0xc0/0x724 [ 47.640865][ T4562] oom_kill_process+0x35c/0x660 [ 47.641751][ T4562] out_of_memory+0xbf0/0xf70 [ 47.642650][ T4562] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.643681][ T4562] try_charge_memcg+0xa4c/0x1390 [ 47.644606][ T4562] obj_cgroup_charge+0x178/0x2e4 [ 47.645540][ T4562] slab_pre_alloc_hook+0x2fc/0x31c [ 47.646501][ T4562] kmem_cache_alloc_lru+0x60/0x284 [ 47.647421][ T4562] new_inode_pseudo+0xdc/0x1cc [ 47.648322][ T4562] new_inode+0x38/0x174 [ 47.649113][ T4562] gadgetfs_create_file+0x74/0x258 [ 47.650082][ T4562] gadgetfs_bind+0x3a8/0x7b0 [ 47.650925][ T4562] gadget_bind_driver+0x26c/0x684 [ 47.651857][ T4562] really_probe+0x3a0/0xac4 [ 47.652769][ T4562] __driver_probe_device+0x1c8/0x368 [ 47.653832][ T4562] driver_probe_device+0x78/0x324 [ 47.654779][ T4562] __driver_attach+0x3bc/0x614 [ 47.655689][ T4562] bus_for_each_dev+0x148/0x1d0 [ 47.656575][ T4562] driver_attach+0x50/0x60 [ 47.657420][ T4562] bus_add_driver+0x2c0/0x518 [ 47.658279][ T4562] driver_register+0x200/0x37c [ 47.659160][ T4562] usb_gadget_register_driver_owner+0xf0/0x25c [ 47.660286][ T4562] dev_config+0xba8/0xfec [ 47.661074][ T4562] vfs_write+0x2a8/0x7c8 [ 47.661869][ T4562] ksys_write+0x12c/0x228 [ 47.662709][ T4562] __arm64_sys_write+0x7c/0x90 [ 47.663597][ T4562] invoke_syscall+0x98/0x290 [ 47.664474][ T4562] el0_svc_common+0x13c/0x258 [ 47.665314][ T4562] do_el0_svc+0x5c/0x134 [ 47.666138][ T4562] el0_svc+0x58/0x12c [ 47.666887][ T4562] el0t_64_sync_handler+0x84/0xf0 [ 47.667797][ T4562] el0t_64_sync+0x18c/0x190 [ 47.670005][ T4562] memory: usage 64kB, limit 96kB, failcnt 216 [ 47.673483][ T4562] memory+swap: usage 32kB, limit 9007199254740988kB, failcnt 0 [ 47.674867][ T4562] kmem: usage 12kB, limit 9007199254740988kB, failcnt 0 [ 47.676040][ T4562] Memory cgroup stats for /syz0/test: [ 47.676125][ T4562] anon 0 [ 47.676125][ T4562] file 0 [ 47.676125][ T4562] kernel 12288 [ 47.676125][ T4562] kernel_stack 0 [ 47.676125][ T4562] pagetables 0 [ 47.676125][ T4562] sec_pagetables 0 [ 47.676125][ T4562] percpu 0 [ 47.676125][ T4562] sock 0 [ 47.676125][ T4562] vmalloc 0 [ 47.676125][ T4562] shmem 0 [ 47.676125][ T4562] zswap 0 [ 47.676125][ T4562] zswapped 0 [ 47.676125][ T4562] file_mapped 0 [ 47.676125][ T4562] file_dirty 0 [ 47.676125][ T4562] file_writeback 0 [ 47.676125][ T4562] swapcached 0 [ 47.676125][ T4562] anon_thp 0 [ 47.676125][ T4562] file_thp 0 [ 47.676125][ T4562] shmem_thp 0 [ 47.676125][ T4562] inactive_anon 0 [ 47.676125][ T4562] active_anon 0 [ 47.676125][ T4562] inactive_file 0 [ 47.676125][ T4562] active_file 0 [ 47.676125][ T4562] unevictable 0 [ 47.676125][ T4562] slab_reclaimable 9056 [ 47.676125][ T4562] slab_unreclaimable 2664 [ 47.676125][ T4562] slab 11720 [ 47.676125][ T4562] workingset_refault_anon 0 [ 47.693899][ T4562] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.31,pid=4562,uid=0 [ 47.696868][ T4562] Memory cgroup out of memory: Killed process 4562 (syz.0.31) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 47.702966][ T4562] gadgetfs: bound to dummy_udc driver [ 47.762437][ T4563] gadgetfs: bound to dummy_udc driver [ 47.775173][ T4564] gadgetfs: bound to dummy_udc driver [ 47.792122][ T4565] syz.0.34 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.793919][ T4565] CPU: 0 PID: 4565 Comm: syz.0.34 Not tainted syzkaller #0 [ 47.795222][ T4565] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.797067][ T4565] Call trace: [ 47.797660][ T4565] dump_backtrace+0x1c4/0x1f0 [ 47.798495][ T4565] show_stack+0x2c/0x3c [ 47.799190][ T4565] __dump_stack+0x30/0x40 [ 47.799947][ T4565] dump_stack_lvl+0xf4/0x15c [ 47.800808][ T4565] dump_stack+0x1c/0x5c [ 47.801585][ T4565] dump_header+0xc0/0x724 [ 47.802410][ T4565] oom_kill_process+0x35c/0x660 [ 47.803322][ T4565] out_of_memory+0xbf0/0xf70 [ 47.804187][ T4565] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.805220][ T4565] try_charge_memcg+0xa4c/0x1390 [ 47.806151][ T4565] obj_cgroup_charge+0x178/0x2e4 [ 47.807086][ T4565] slab_pre_alloc_hook+0x2fc/0x31c [ 47.808052][ T4565] kmem_cache_alloc_lru+0x60/0x284 [ 47.808975][ T4565] __d_alloc+0x40/0x68c [ 47.809738][ T4565] d_alloc+0x54/0x208 [ 47.810459][ T4565] lookup_one_qstr_excl+0xbc/0x230 [ 47.811388][ T4565] filename_create+0x1d0/0x3a8 [ 47.812285][ T4565] do_mkdirat+0xac/0x3ec [ 47.813095][ T4565] __arm64_sys_mkdirat+0x90/0xa8 [ 47.814020][ T4565] invoke_syscall+0x98/0x290 [ 47.814890][ T4565] el0_svc_common+0x13c/0x258 [ 47.815760][ T4565] do_el0_svc+0x5c/0x134 [ 47.816533][ T4565] el0_svc+0x58/0x12c [ 47.817279][ T4565] el0t_64_sync_handler+0x84/0xf0 [ 47.818193][ T4565] el0t_64_sync+0x18c/0x190 [ 47.820360][ T4565] memory: usage 92kB, limit 96kB, failcnt 263 [ 47.821812][ T4565] memory+swap: usage 92kB, limit 9007199254740988kB, failcnt 0 [ 47.823172][ T4565] kmem: usage 64kB, limit 9007199254740988kB, failcnt 0 [ 47.824344][ T4565] Memory cgroup stats for /syz0/test: [ 47.824434][ T4565] anon 0 [ 47.824434][ T4565] file 0 [ 47.824434][ T4565] kernel 65536 [ 47.824434][ T4565] kernel_stack 0 [ 47.824434][ T4565] pagetables 0 [ 47.824434][ T4565] sec_pagetables 0 [ 47.824434][ T4565] percpu 0 [ 47.824434][ T4565] sock 0 [ 47.824434][ T4565] vmalloc 0 [ 47.824434][ T4565] shmem 0 [ 47.824434][ T4565] zswap 0 [ 47.824434][ T4565] zswapped 0 [ 47.824434][ T4565] file_mapped 0 [ 47.824434][ T4565] file_dirty 0 [ 47.824434][ T4565] file_writeback 0 [ 47.824434][ T4565] swapcached 0 [ 47.824434][ T4565] anon_thp 0 [ 47.824434][ T4565] file_thp 0 [ 47.824434][ T4565] shmem_thp 0 [ 47.824434][ T4565] inactive_anon 0 [ 47.824434][ T4565] active_anon 0 [ 47.824434][ T4565] inactive_file 0 [ 47.824434][ T4565] active_file 0 [ 47.824434][ T4565] unevictable 0 [ 47.824434][ T4565] slab_reclaimable 59328 [ 47.824434][ T4565] slab_unreclaimable 2664 [ 47.824434][ T4565] slab 61992 [ 47.824434][ T4565] workingset_refault_anon 0 [ 47.842797][ T4565] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.34,pid=4565,uid=0 [ 47.845341][ T4565] Memory cgroup out of memory: Killed process 4565 (syz.0.34) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 47.912899][ T4566] gadgetfs: bound to dummy_udc driver [ 47.925173][ T4567] gadgetfs: bound to dummy_udc driver [ 47.940179][ T4568] syz.0.37 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 [ 47.941949][ T4568] CPU: 1 PID: 4568 Comm: syz.0.37 Not tainted syzkaller #0 [ 47.943154][ T4568] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 47.945002][ T4568] Call trace: [ 47.945629][ T4568] dump_backtrace+0x1c4/0x1f0 [ 47.946462][ T4568] show_stack+0x2c/0x3c [ 47.947184][ T4568] __dump_stack+0x30/0x40 [ 47.947939][ T4568] dump_stack_lvl+0xf4/0x15c [ 47.948749][ T4568] dump_stack+0x1c/0x5c [ 47.949462][ T4568] dump_header+0xc0/0x724 [ 47.950212][ T4568] oom_kill_process+0x35c/0x660 [ 47.951110][ T4568] out_of_memory+0xbf0/0xf70 [ 47.951983][ T4568] mem_cgroup_out_of_memory+0x228/0x2d0 [ 47.953111][ T4568] try_charge_memcg+0xa4c/0x1390 [ 47.954052][ T4568] obj_cgroup_charge+0x178/0x2e4 [ 47.954957][ T4568] slab_pre_alloc_hook+0x2fc/0x31c [ 47.956052][ T4568] kmem_cache_alloc_lru+0x60/0x284 [ 47.957072][ T4568] new_inode_pseudo+0xdc/0x1cc [ 47.957998][ T4568] new_inode+0x38/0x174 [ 47.958788][ T4568] gadgetfs_create_file+0x74/0x258 [ 47.959754][ T4568] gadgetfs_bind+0x3a8/0x7b0 [ 47.960646][ T4568] gadget_bind_driver+0x26c/0x684 [ 47.961613][ T4568] really_probe+0x3a0/0xac4 [ 47.962442][ T4568] __driver_probe_device+0x1c8/0x368 [ 47.963422][ T4568] driver_probe_device+0x78/0x324 [ 47.964511][ T4568] __driver_attach+0x3bc/0x614 [ 47.965510][ T4568] bus_for_each_dev+0x148/0x1d0 [ 47.966460][ T4568] driver_attach+0x50/0x60 [ 47.967320][ T4568] bus_add_driver+0x2c0/0x518 [ 47.968347][ T4568] driver_register+0x200/0x37c [ 47.969238][ T4568] usb_gadget_register_driver_owner+0xf0/0x25c [ 47.970397][ T4568] dev_config+0xba8/0xfec [ 47.971230][ T4568] vfs_write+0x2a8/0x7c8 [ 47.972130][ T4568] ksys_write+0x12c/0x228 [ 47.973036][ T4568] __arm64_sys_write+0x7c/0x90 [ 47.974047][ T4568] invoke_syscall+0x98/0x290 [ 47.974997][ T4568] el0_svc_common+0x13c/0x258 [ 47.975871][ T4568] do_el0_svc+0x5c/0x134 [ 47.976692][ T4568] el0_svc+0x58/0x12c [ 47.977450][ T4568] el0t_64_sync_handler+0x84/0xf0 [ 47.978353][ T4568] el0t_64_sync+0x18c/0x190 [ 47.981301][ T4568] memory: usage 96kB, limit 96kB, failcnt 305 [ 47.982397][ T4568] memory+swap: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 47.983637][ T4568] kmem: usage 96kB, limit 9007199254740988kB, failcnt 0 [ 47.984816][ T4568] Memory cgroup stats for /syz0/test: [ 47.984902][ T4568] anon 0 [ 47.984902][ T4568] file 0 [ 47.984902][ T4568] kernel 98304 [ 47.984902][ T4568] kernel_stack 0 [ 47.984902][ T4568] pagetables 0 [ 47.984902][ T4568] sec_pagetables 0 [ 47.984902][ T4568] percpu 0 [ 47.984902][ T4568] sock 0 [ 47.984902][ T4568] vmalloc 0 [ 47.984902][ T4568] shmem 0 [ 47.984902][ T4568] zswap 0 [ 47.984902][ T4568] zswapped 0 [ 47.984902][ T4568] file_mapped 0 [ 47.984902][ T4568] file_dirty 0 [ 47.984902][ T4568] file_writeback 0 [ 47.984902][ T4568] swapcached 0 [ 47.984902][ T4568] anon_thp 0 [ 47.984902][ T4568] file_thp 0 [ 47.984902][ T4568] shmem_thp 0 [ 47.984902][ T4568] inactive_anon 0 [ 47.984902][ T4568] active_anon 0 [ 47.984902][ T4568] inactive_file 0 [ 47.984902][ T4568] active_file 0 [ 47.984902][ T4568] unevictable 0 [ 47.984902][ T4568] slab_reclaimable 88928 [ 47.984902][ T4568] slab_unreclaimable 5976 [ 47.984902][ T4568] slab 94904 [ 47.984902][ T4568] workingset_refault_anon 0 [ 48.003486][ T4568] oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=test,mems_allowed=0,oom_memcg=/syz0/test,task_memcg=/syz0/test,task=syz.0.37,pid=4568,uid=0 [ 48.006197][ T4568] Memory cgroup out of memory: Killed process 4568 (syz.0.37) total-vm:44896kB, anon-rss:1308kB, file-rss:0kB, shmem-rss:0kB, UID:0 pgtables:76kB oom_score_adj:1000 [ 48.012423][ T4568] udc dummy_udc.0: failed to start USB Gadget filesystem: -12 [ 48.013690][ T4568] gadgetfs: probe of gadget.0 failed with error -12 [ 48.015068][ T4568] gadgetfs expected dummy_udc controller not usbip-vudc [ 48.016161][ T4568] udc usbip-vudc.0: failed to start USB Gadget filesystem: -19 [ 48.017772][ T4568] UDC core: USB Gadget filesystem: couldn't find an available UDC [ 48.070623][ T4569] ================================================================== [ 48.072162][ T4569] BUG: KASAN: use-after-free in __lock_acquire+0x104/0x7280 [ 48.073438][ T4569] Read of size 8 at addr ffff0000d60cb018 by task syz.0.38/4569 [ 48.074752][ T4569] [ 48.075140][ T4569] CPU: 0 PID: 4569 Comm: syz.0.38 Not tainted syzkaller #0 [ 48.076343][ T4569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 48.078149][ T4569] Call trace: [ 48.078755][ T4569] dump_backtrace+0x1c4/0x1f0 [ 48.079583][ T4569] show_stack+0x2c/0x3c [ 48.080359][ T4569] __dump_stack+0x30/0x40 [ 48.081163][ T4569] dump_stack_lvl+0xf4/0x15c [ 48.082033][ T4569] print_address_description+0x88/0x218 [ 48.083061][ T4569] print_report+0x50/0x68 [ 48.083894][ T4569] kasan_report+0xa8/0xfc [ 48.084694][ T4569] __asan_report_load8_noabort+0x2c/0x38 [ 48.085689][ T4569] __lock_acquire+0x104/0x7280 [ 48.086557][ T4569] lock_acquire+0x210/0x63c [ 48.087377][ T4569] _raw_spin_lock_irq+0x70/0x98 [ 48.088297][ T4569] gadget_dev_open+0x50/0x1c4 [ 48.089189][ T4569] do_dentry_open+0x738/0xf8c [ 48.090027][ T4569] vfs_open+0x7c/0x90 [ 48.090743][ T4569] path_openat+0x1fc0/0x27a0 [ 48.091595][ T4569] do_filp_open+0x198/0x38c [ 48.092379][ T4569] do_sys_openat2+0x134/0x3fc [ 48.093205][ T4569] __arm64_sys_openat+0x11c/0x150 [ 48.094067][ T4569] invoke_syscall+0x98/0x290 [ 48.094876][ T4569] el0_svc_common+0x13c/0x258 [ 48.095729][ T4569] do_el0_svc+0x5c/0x134 [ 48.096472][ T4569] el0_svc+0x58/0x12c [ 48.097209][ T4569] el0t_64_sync_handler+0x84/0xf0 [ 48.098133][ T4569] el0t_64_sync+0x18c/0x190 [ 48.098944][ T4569] [ 48.099363][ T4569] Allocated by task 4486: [ 48.100153][ T4569] kasan_set_track+0x4c/0x80 [ 48.100996][ T4569] kasan_save_alloc_info+0x24/0x30 [ 48.101941][ T4569] __kasan_kmalloc+0xa0/0xb8 [ 48.102787][ T4569] kmalloc_trace+0x7c/0x94 [ 48.103617][ T4569] gadgetfs_fill_super+0x2c0/0x5c0 [ 48.104556][ T4569] get_tree_single+0xb8/0x170 [ 48.105414][ T4569] gadgetfs_get_tree+0x28/0x38 [ 48.106289][ T4569] vfs_get_tree+0x90/0x278 [ 48.107057][ T4569] do_new_mount+0x228/0x804 [ 48.107875][ T4569] path_mount+0x5ac/0xe6c [ 48.108656][ T4569] __arm64_sys_mount+0x4a0/0x5a0 [ 48.109560][ T4569] invoke_syscall+0x98/0x290 [ 48.110396][ T4569] el0_svc_common+0x13c/0x258 [ 48.111196][ T4569] do_el0_svc+0x5c/0x134 [ 48.111955][ T4569] el0_svc+0x58/0x12c [ 48.112663][ T4569] el0t_64_sync_handler+0x84/0xf0 [ 48.113553][ T4569] el0t_64_sync+0x18c/0x190 [ 48.114355][ T4569] [ 48.114773][ T4569] Freed by task 4568: [ 48.115477][ T4569] kasan_set_track+0x4c/0x80 [ 48.116286][ T4569] kasan_save_free_info+0x38/0x5c [ 48.117195][ T4569] ____kasan_slab_free+0x148/0x1b0 [ 48.118119][ T4569] __kasan_slab_free+0x18/0x28 [ 48.119024][ T4569] slab_free_freelist_hook+0x16c/0x1e8 [ 48.120052][ T4569] __kmem_cache_free+0xbc/0x21c [ 48.120940][ T4569] kfree+0xd0/0x1a8 [ 48.121638][ T4569] dev_release+0x160/0x214 [ 48.122464][ T4569] __fput+0x1b4/0x7b0 [ 48.123165][ T4569] ____fput+0x20/0x30 [ 48.123878][ T4569] task_work_run+0x1f4/0x280 [ 48.124696][ T4569] do_exit+0x54c/0x19ac [ 48.125431][ T4569] do_group_exit+0x198/0x238 [ 48.126270][ T4569] get_signal+0x11f4/0x133c [ 48.127074][ T4569] do_notify_resume+0x364/0x2c84 [ 48.127956][ T4569] el0_svc+0x9c/0x12c [ 48.128733][ T4569] el0t_64_sync_handler+0x84/0xf0 [ 48.129697][ T4569] el0t_64_sync+0x18c/0x190 [ 48.130500][ T4569] [ 48.130920][ T4569] The buggy address belongs to the object at ffff0000d60cb000 [ 48.130920][ T4569] which belongs to the cache kmalloc-1k of size 1024 [ 48.133428][ T4569] The buggy address is located 24 bytes inside of [ 48.133428][ T4569] 1024-byte region [ffff0000d60cb000, ffff0000d60cb400) [ 48.135808][ T4569] [ 48.136216][ T4569] The buggy address belongs to the physical page: [ 48.137371][ T4569] page:00000000e310e358 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1160c8 [ 48.139244][ T4569] head:00000000e310e358 order:3 compound_mapcount:0 compound_pincount:0 [ 48.140755][ T4569] flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) [ 48.142233][ T4569] raw: 05ffc00000010200 fffffc00034f2000 dead000000000002 ffff0000c0002780 [ 48.143801][ T4569] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 48.145348][ T4569] page dumped because: kasan: bad access detected [ 48.146467][ T4569] [ 48.146888][ T4569] Memory state around the buggy address: [ 48.148017][ T4569] ffff0000d60caf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.149458][ T4569] ffff0000d60caf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 48.150901][ T4569] >ffff0000d60cb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.152417][ T4569] ^ [ 48.153258][ T4569] ffff0000d60cb080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.154652][ T4569] ffff0000d60cb100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 48.156068][ T4569] ================================================================== [ 48.157519][ T4569] Disabling lock debugging due to kernel taint [ 48.158568][ T4569] ================================================================================ [ 48.160166][ T4569] UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9 [ 48.161611][ T4569] index 13407 is out of range for type 'unsigned long[8]' [ 48.162844][ T4569] CPU: 0 PID: 4569 Comm: syz.0.38 Tainted: G B syzkaller #0 [ 48.164405][ T4569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 48.166220][ T4569] Call trace: [ 48.166838][ T4569] dump_backtrace+0x1c4/0x1f0 [ 48.167719][ T4569] show_stack+0x2c/0x3c [ 48.168503][ T4569] __dump_stack+0x30/0x40 [ 48.169302][ T4569] dump_stack_lvl+0xf4/0x15c [ 48.170126][ T4569] dump_stack+0x1c/0x5c [ 48.170875][ T4569] ubsan_epilogue+0x14/0x48 [ 48.171694][ T4569] __ubsan_handle_out_of_bounds+0xd0/0xf8 [ 48.172731][ T4569] queued_spin_lock_slowpath+0x8a8/0xc14 [ 48.173753][ T4569] do_raw_spin_lock+0x2f4/0x2f8 [ 48.174601][ T4569] _raw_spin_lock_irq+0x78/0x98 [ 48.175492][ T4569] gadget_dev_open+0x50/0x1c4 [ 48.176369][ T4569] do_dentry_open+0x738/0xf8c [ 48.177200][ T4569] vfs_open+0x7c/0x90 [ 48.177899][ T4569] path_openat+0x1fc0/0x27a0 [ 48.178723][ T4569] do_filp_open+0x198/0x38c [ 48.179523][ T4569] do_sys_openat2+0x134/0x3fc [ 48.180344][ T4569] __arm64_sys_openat+0x11c/0x150 [ 48.181250][ T4569] invoke_syscall+0x98/0x290 [ 48.182083][ T4569] el0_svc_common+0x13c/0x258 [ 48.182875][ T4569] do_el0_svc+0x5c/0x134 [ 48.183612][ T4569] el0_svc+0x58/0x12c [ 48.184314][ T4569] el0t_64_sync_handler+0x84/0xf0 [ 48.185171][ T4569] el0t_64_sync+0x18c/0x190 [ 48.185932][ T4569] ================================================================================ [ 48.187558][ T4569] Unable to handle kernel paging request at virtual address ffff80001638b1a0 [ 48.189088][ T4569] KASAN: probably user-memory-access in range [0x00000000b1c58d00-0x00000000b1c58d07] [ 48.190703][ T4569] Mem abort info: [ 48.191324][ T4569] ESR = 0x0000000096000047 [ 48.192111][ T4569] EC = 0x25: DABT (current EL), IL = 32 bits [ 48.193171][ T4569] SET = 0, FnV = 0 [ 48.193854][ T4569] EA = 0, S1PTW = 0 [ 48.194550][ T4569] FSC = 0x07: level 3 translation fault [ 48.195555][ T4569] Data abort info: [ 48.196221][ T4569] ISV = 0, ISS = 0x00000047 [ 48.197037][ T4569] CM = 0, WnR = 1 [ 48.197741][ T4569] swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000020bbcc000 [ 48.199063][ T4569] [ffff80001638b1a0] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000023fffa003, pte=0000000000000000 [ 48.201475][ T4569] Internal error: Oops: 0000000096000047 [#1] PREEMPT SMP [ 48.202761][ T4569] Modules linked in: [ 48.203486][ T4569] CPU: 0 PID: 4569 Comm: syz.0.38 Tainted: G B syzkaller #0 [ 48.205037][ T4569] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 [ 48.206840][ T4569] pstate: 824000c5 (Nzcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) [ 48.208189][ T4569] pc : queued_spin_lock_slowpath+0x598/0xc14 [ 48.209253][ T4569] lr : queued_spin_lock_slowpath+0x8a8/0xc14 [ 48.210316][ T4569] sp : ffff800022107520 [ 48.211040][ T4569] x29: ffff8000221075c0 x28: 1fffe00033c1b030 x27: ffff80001638b1a0 [ 48.212490][ T4569] x26: ffff00019e0d8188 x25: ffff800022107540 x24: 1fffe0001ac19600 [ 48.213983][ T4569] x23: dfff800000000000 x22: ffff700004420ea8 x21: ffff80001638b1a0 [ 48.215442][ T4569] x20: ffff00019e0d8180 x19: ffff0000d60cb000 x18: 0000000000000000 [ 48.216845][ T4569] x17: 3d3d3d3d3d3d3d3d x16: ffff800008195558 x15: 3d3d3d3d3d3d3d3d [ 48.218285][ T4569] x14: ffff700003203abc x13: 1ffff00003203abc x12: 0000000000000004 [ 48.219767][ T4569] x11: ff008000081955dc x10: ffff80001638b180 x9 : 0000000000000002 [ 48.221271][ T4569] x8 : 0000000000000000 x7 : 0000000000000001 x6 : 0000000000000001 [ 48.222682][ T4569] x5 : ffff800022106f78 x4 : ffff800016504f40 x3 : ffff8000081955a4 [ 48.224108][ T4569] x2 : 0000000000000001 x1 : 0000000000000004 x0 : ffff00019e0d8188 [ 48.225538][ T4569] Call trace: [ 48.226121][ T4569] queued_spin_lock_slowpath+0x598/0xc14 [ 48.227182][ T4569] do_raw_spin_lock+0x2f4/0x2f8 [ 48.228093][ T4569] _raw_spin_lock_irq+0x78/0x98 [ 48.229065][ T4569] gadget_dev_open+0x50/0x1c4 [ 48.229979][ T4569] do_dentry_open+0x738/0xf8c [ 48.230876][ T4569] vfs_open+0x7c/0x90 [ 48.231635][ T4569] path_openat+0x1fc0/0x27a0 [ 48.232494][ T4569] do_filp_open+0x198/0x38c [ 48.233326][ T4569] do_sys_openat2+0x134/0x3fc [ 48.234210][ T4569] __arm64_sys_openat+0x11c/0x150 [ 48.235206][ T4569] invoke_syscall+0x98/0x290 [ 48.236086][ T4569] el0_svc_common+0x13c/0x258 [ 48.237003][ T4569] do_el0_svc+0x5c/0x134 [ 48.237832][ T4569] el0_svc+0x58/0x12c [ 48.238628][ T4569] el0t_64_sync_handler+0x84/0xf0 [ 48.239605][ T4569] el0t_64_sync+0x18c/0x190 [ 48.240456][ T4569] Code: aa1503e0 978cfdf8 91002280 52800081 (f90002b4) [ 48.241731][ T4569] ---[ end trace 0000000000000000 ]--- [ 52.063301][ T4569] Kernel panic - not syncing: Oops: Fatal exception [ 52.064482][ T4569] SMP: stopping secondary CPUs [ 52.065308][ T4569] Kernel Offset: disabled [ 52.066077][ T4569] CPU features: 0x0a0000,000f0097,a65bfea7 [ 52.067090][ T4569] Memory Limit: none [ 55.564619][ T4569] Rebooting in 86400 seconds..